How the Strike agent works

Strike's AI agent is the core component that runs Threat Emulations on your assets. It combines artificial intelligence with expert oversight to simulate the behavior of a real attacker.

Its design lets you assess your systems continuously, automatically and in a controlled way, with accuracy, speed and safety in every run.

Threat Emulation engine

The AI agent runs every Threat Emulation you configure. If you turn on Human hacking, a security specialist also manually tests the in-scope assets, alongside the agent.

Each Threat Emulation has a testing type:

• Full security: complete testing of the entire in-scope surface. It can be recurring or a single run.

• Focused: a one-off run on a target you define.

• Change-based: runs automatically when there are changes in the repositories you choose.

To see when each one makes sense, see Focused and Change-based Threat Emulation: how they differ and when to use each one.

Human validation of results

All findings go through triage by Strike's Hacking Team before they are published. In addition, 100% of critical findings are reproduced and validated manually. AI brings speed, depth and coverage, but critical decisions are made by expert ethical hackers.

The Hacking Team:

• Confirms vulnerabilities.

• Removes false positives.

• Reproduces findings.

• Assesses the real impact.

This way, the results you receive are accurate and actionable. To learn more about the team, see How Strike's Hacking Team works internally.

Model-agnostic engine

The engine does not depend on a single provider: it can work with proprietary models, open-source models or models from leading providers, and it picks the most suitable one for each task.

Isolation and data

• Each client is processed in isolated contexts: agents never access another client's information.

• Everything operates in inference mode (not training): data is not used to train models and is not retained beyond processing.

• When each run ends, the environment is destroyed, temporary data is deleted and sessions are closed.

• Access control and full traceability.

Each run is independent and does not share state with others.

End-to-end flow

The process follows four stages: discovery, validation, remediation and verification. A proprietary data layer, built from thousands of hours of pentesting, continuously improves detection.

How the agent works

During each run, the agent:

• Simulates real attack paths.

• Runs multiple tests in parallel.

• Adapts to the context of each asset.

• Prioritizes based on dependencies and complexity.

This makes it possible to detect both technical and business logic vulnerabilities.

Controls and operational safety

The agent is designed to operate safely in production environments. It includes:

• Execution within the limits you define.

• Exclusion of destructive actions.

• Real-time monitoring.

• Immediate stop mechanism (kill switch).

• Automatic stop on anomalous behavior.

To see in detail what the agent can and cannot do, and how to audit its behavior, see How Strike's AI agent operates on your assets: scope, limits and controls.

Testing scope

The agent mainly assesses:

• Web applications (public and private).

• APIs and backend services.

• Exposed business logic.

It can also operate on private environments through VPN or with Strike's IPs authorized in your firewall. For more details, see How to authorize Strike's IPs.

In short, Strike's AI agent combines a continuous emulation engine, parallel execution and expert validation by the Hacking Team to deliver continuous, accurate testing aligned with your business's real risk.